M41: harden trust boundaries and delivery

docs/08-return-workflow.md

@@ -27,7 +27,8 @@ created, and next-booking risk. `register_vehicle_return` (below) calls the same
 1. Authorize Rental Employee or Operations Manager.
 2. Lock booking and vehicle rows.
 3. Reject cancelled/already-returned booking unless idempotency replay matches.
-4. Validate required fields and submitted reading against booking start reading.
+4. Validate required fields; compare the submitted reading only with the vehicle's
+   canonical odometer so a lower reading is recorded as evidence instead of rejected.
 5. Create a return inspection.
 6. Set booking to returned and store submitted end reading.
 7. If submitted reading >= canonical odometer, update canonical odometer.

docs/11-n8n-integration.md

@@ -20,10 +20,6 @@ The canonical, live-validated definition is `n8n/workflows/fleet-ops-vehicle-ret
 
 ## Second live workflow: scheduled quality scan
 
-RAGcore is not connected in this environment, so the originally sketched "knowledge sync"
-workflow below remains deferred (see "Deferred: knowledge sync"). The second implemented
-workflow does not depend on RAGcore or MCP Hub, so it is not blocked by them.
-
 Input: hourly schedule trigger, or a manual trigger for on-demand testing.
 
 Steps:
@@ -45,16 +41,15 @@ workflow (see `deploy/unraid/setup-scheduled-scan.sh` and `docs/17-runbook.md`).
 active on the live instance; a fresh import ships inactive until credentials are wired up
 and it is deliberately published.
 
-## RAGcore procedure sync (in progress)
+## RAGcore procedure sync
 
-RAGcore is now reachable in this environment; a live inspection of its real contract is
-recorded in `docs/live-ai-integration/n8n-current-state.md`. Workflow 3, "Fleet Ops —
-RAGcore Procedure Sync", is being built against that real contract (not the sketch
-originally in this section) — see `n8n/workflows/MANIFEST.md` for current status.
+Workflow 3, "Fleet Ops — RAGcore Procedure Sync", is published and active against the
+live RAGcore contract. See `n8n/workflows/MANIFEST.md` for its bounded upload contract,
+credentials and live validation evidence.
 
-## Workflow error handler (in progress)
+## Workflow error handler
 
-Workflow 4, "Fleet Ops — Workflow Error Handler", is a central technical workflow attached
+Workflow 4, "Fleet Ops — Workflow Error Handler", is active and attached
 to workflows 1-3 via n8n's per-workflow "Error Workflow" setting, reporting bounded,
 secret-free failure details to Fleet Ops. See `n8n/workflows/MANIFEST.md` for status.
 

docs/17-runbook.md

@@ -71,8 +71,8 @@ On startup the API creates the first active Operations Manager only when no user
 email exists. The sign-in page then accepts email/password instead of exposing demo roles;
 demo reset, the guided tour and the synthetic-data badge are hidden.
 
-Use a long unique `APP_SECRET`, set `SESSION_COOKIE_SECURE=true` once the public endpoint
-uses HTTPS, and keep `INITIAL_ADMIN_PASSWORD` out of Git and logs. Existing sessions are
+Use a long unique `APP_SECRET`; production requires an HTTPS public endpoint and
+`SESSION_COOKIE_SECURE=true`. Keep `INITIAL_ADMIN_PASSWORD` out of Git and logs. Existing sessions are
 revalidated against the current user record on every request, so deactivating an account
 invalidates its next request.
 
@@ -168,17 +168,17 @@ deliberately published with a real service token.
 
 ### Existing shared n8n on the Unraid review server
 
-The Unraid deployment uses the existing n8n at `http://192.168.10.150:5678`; it does not
+The Unraid deployment uses the existing n8n at `https://n8n.itworx.tech`; it does not
 start MobilityOps's bundled n8n service. `compose.unraid.yaml` places that fallback behind
 the opt-in `bundled-n8n` profile. Configure the API target and publish the workflow with:
 
 ```bash
 sed -i \
-  's|^N8N_WEBHOOK_URL=.*|N8N_WEBHOOK_URL=http://192.168.10.150:5678/webhook/mobilityops-return|' \
+  's|^N8N_WEBHOOK_URL=.*|N8N_WEBHOOK_URL=https://n8n.itworx.tech/webhook/mobilityops-return|' \
   .env
 ./deploy/unraid/setup-existing-n8n.sh \
   n8n \
-  http://192.168.10.150:1236/api/v1/integrations/n8n/return-callback
+  https://fleetops.itworx.tech/api/v1/integrations/n8n/return-callback
 docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml up -d db api web
 ```
 
@@ -215,7 +215,7 @@ Publish the scheduled quality-scan workflow the same way:
 ```bash
 ./deploy/unraid/setup-scheduled-scan.sh \
   n8n \
-  http://192.168.10.150:1236/api/v1/integrations/n8n/scheduled-scan
+  https://fleetops.itworx.tech/api/v1/integrations/n8n/scheduled-scan
 ```
 
 ## Required operational checks